Personal data processing instruction

This Instruction is part of the public offer (Terms of Service) of Tuqo (section 17). It describes how Tuqo processes the personal data of visitors of the User's sites: those who open the User's site, submit forms, sign up or pay for access. The User (the site owner) is the operator of this data; Tuqo is the person processing it on the User's instruction (Part 3 of Article 6 of Federal Law No. 152-FZ “On Personal Data”). Acceptance of the offer constitutes both giving and accepting the Instruction; nothing needs to be signed separately.

The document is written so that it can be quoted in your personal data processing policy and in your notification to Roskomnadzor (the Russian data protection authority); see section 8.

1. Parties and roles

Operator (the User): the person who has hosted a site on Tuqo. The Operator determines the purposes of processing the data of their visitors, its scope and legal grounds, and is responsible to the visitors and to the authorized body.

Processor (Tuqo): Individual entrepreneur (sole proprietor) Aleksandr Viktorovich Antonov, TIN (INN) 262517638904, OGRNIP 312265133100116. It processes visitors' data solely for the purposes and to the extent of the Instruction, without determining the purposes of processing and without using the data in its own interests.

Two roles of one platform. With respect to the data of visitors of the User's sites, Tuqo is a processor under this Instruction. With respect to technical access logs, abuse prevention, traffic accounting and settlements with the User under their plan, Tuqo acts as an independent operator; this is described in the Privacy Policy.

2. Subject of the instruction

Processing is automated and takes place in the following scenarios:

List of actions in all scenarios: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, anonymization, blocking, deletion, destruction. Transfer to third parties: only to subprocessors (section 4) and to the User's payment provider of the User's choice.

Not intended for processing special categories of personal data (health, beliefs, intimate life, etc.), biometric data or data of minors. The User may not collect such data using the Service, and visitors may not enter it.

3. Processor's obligations

1. Process data only for the purposes and to the extent set out in section 2, following the User's documented instructions, namely the settings of the User's site in the control panel.
2. Maintain confidentiality; not disclose data to third parties except in cases expressly provided for by law or by this Instruction.
3. Take the measures provided for by Article 19 of Federal Law No. 152-FZ: encryption in transit (HTTPS), access control, storing secrets and keys in encrypted form, pseudonymization of blocks, access logging.
4. Store data in the territory of the Russian Federation; not carry out cross-border transfer.
5. Notify the User of an incident affecting visitors' data at the email address of the User's account within 24 hours of its detection, with the information known at that moment, and supplement the notification once the investigation is complete. Notifying the authorized body and the data subjects is the User's obligation as the operator; the Processor provides the information needed for this.
6. Forward visitors' requests (access, correction, deletion, withdrawal of consent) received by Tuqo to the User within 3 business days, without passing the requester's personal data to any other persons; it is the User who answers the visitor.
7. Destroy data: when the User deletes a member or a site, immediately; upon a separate request of the User, within 30 days at most; upon termination of the contract, within the periods set out in the Privacy Policy. Payment records: after 3 years from the payment date.
8. At the User's request, provide information about the protection measures taken and about subprocessors, no more than once per quarter.

4. Subprocessors

To carry out the Instruction, the Processor engages infrastructure providers acting on its instruction; all of them keep data in the Russian Federation:

• TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД», TIN 7810945525, OGRN 1227800052215; office 605, 7 Universitetskaya St., Innopolis, Republic of Tatarstan, 420500): servers, databases and object storage for site files (Timeweb Cloud);
• the payment provider (T-Bank or YooKassa) in the “Paid access” mode, under the User's own agreement: it processes the buyer's data as an independent operator; the Processor only passes it the information needed for the payment and the receipt.

The Service's emails (sign-in codes, notifications, auto-replies on behalf of sites) are sent from the Processor's own mail server; no third-party email service is used.

A subprocessor is replaced or added with email notice to Users at least 15 days in advance; a User who does not agree with the change may stop using the Service. Current details of the subprocessors are in the Privacy Policy, section 5.

5. Operator's (User's) obligations

1. Have a legal ground for processing the data of their visitors and confirm it at the Processor's request.
2. Inform visitors about the processing: publish their own personal data processing policy on the site and, for sign-up or payment, their own documents (offer, terms); the Service shows them on the login screen and records consent to them. Ready-made templates are available from the generator in the control panel; they are recommendations only.
3. State processing on instruction and the processor in the Roskomnadzor notification (section 8), if the User is obliged to file a notification.
4. Use the data of members and buyers only to provide access, fulfil obligations and handle requests; send advertising mailings only on the basis of separate consent obtained by the User independently (Federal Law No. 38-FZ “On Advertising”). The Service sends visitors only service messages: sign-in codes, notifications about access status and about payment.
5. Respond to requests from visitors and buyers; not collect, using the Service, the data listed in section 2 as not intended for processing.
6. Bear sole responsibility towards visitors and the authorized body for the lawfulness of processing; compensate the Processor for losses arising from a breach of these obligations.

6. Liability

The Processor is liable to the User for a breach of the obligations in section 3 within the limits set by the offer (section 12). The Processor is not liable for the lawfulness of processing, the existence of grounds and consents, the scope of the data collected or the content of the User's documents.

7. Term

The Instruction remains in effect for the term of the contract under the offer. When the User deletes an account or a site, processing of the corresponding data stops and the data is destroyed as set out in section 3.

8. Text for your policy and the Roskomnadzor notification

A paragraph you can include in your site's personal data processing policy:

“For hosting the site, receiving submissions, and signing up and signing in visitors, the Operator entrusts the processing of personal data to Individual entrepreneur (sole proprietor) Aleksandr Viktorovich Antonov (TIN (INN) 262517638904, the Tuqo service, https://tuqo.ru) to the extent necessary for the site to work: storing the email address, name and snapshot of consents, sending sign-in codes and service notifications on behalf of the site, keeping technical logs. The terms of processing on instruction: https://tuqo.ru/legal/dpa/. The data is stored in the territory of the Russian Federation.”

Translator's note: if your policy is in Russian, use the Russian wording of this paragraph from the original (in Russian); the processor's name in Russian is Индивидуальный предприниматель Антонов Александр Викторович.

In the Roskomnadzor notification (if you are obliged to file one), state “transfer” as one of the processing methods and name the processor acting on instruction: Individual entrepreneur (sole proprietor) Aleksandr Viktorovich Antonov (Индивидуальный предприниматель Антонов Александр Викторович), TIN (INN) 262517638904; place of processing: the data centers of the infrastructure provider TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД», Timeweb Cloud) in the territory of the Russian Federation.

9. Related documents

Public offer (Terms of Service) (sections 17–18), Privacy Policy, Tuqo terms for site visitors, Cookie Policy.